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INTRODUCTION 


A survey of foreign technology in flight crucial flight controls 
is being conducted for NASA Langley Research Center as a data base for 
planning future research and technology programs. Only Free World 
countries were surveyed, and the primary emphasis was on Western Europe 
because that is where the most advanced technology resides. The survey 
includes major contemporary systems on operational aircraft, R&D flight 
programs, advanced aircraft developments, and major research and 
technology programs. The information was collected from open 
literature, personal communications, ,and a tour of several companies, 
government organizations, and research laboratories in the United 
Kingdom, France, and the Federal Republic of Germany. This paper 
provides a summary of the survey results to date. 

Some of the figures are taken from a briefing to the NASA 
Administrator by Mr. Kenneth Szalai from Ames Research Center, Dryden 
Flight Research Facility, on the technology tour of Europe that 
Mr. Szalai and the author conducted in 1983. These figures are used 
with the permission of Mr. Szalai. 

This survey was conducted under contract NAS1-17403, and the 
Technical Representative of the Contracting Officer was Mr. Cary 
Spitzer, NASA Langley Research Center. The material presented herein 
solely represents the findings and opinions of the author and is not to 
be construed as being endorsed by the U.S. Government or representa- 
tives of the National Aeronautics and Space Administration. 
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FLIGHT CONTROL SYSTEMS EVOLUTION 


Flight controls technology has undergone tremendous evolution over 
the past three decades. Figure 1 illustrates many of the key 
milestones in the evolution as represented by major R&D systems and 
operational systems. The term "nonflight critical fly-by-wire" refers 
to systems that are commanded by electric or optical signals, but loss of 
those signals is not likely to cause the aircraft to crash. Typically, 
there is also a mechanical/hydraulic path for primary control or as a 
backup system. Flight critical fly-by-wire means that loss of that 
system is likely to cause the aircraft to crash. 

Although the chart emphasizes U.S. aircraft, several key develop- 
ments in Europe are included, and those of current interest are 
discussed subsequently. The Concord had a very profound effect on 
European flight controls technology in two ways. It represented the 
first, and as yet only, high authority SAS/CAS in commercial transports 
and provided a very important experience base for the UK and France 
technologists and managers. That has helped influence an early 
commitment to fly-by-wire in the Airbus. Secondly, it accelerated the 
development of the technology in France because the French engineers 
gained valuable experience working directly with the Marconi engineers 
on the Concord system. There is now a solid base of DFBW technology in 
Europe and wide-spread commitment to DFBW for military aircraft and in 
some cases, commercial transports. 
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JA-37 AND AIRBUS A-310 


The Swedish JA-37 Viggen fighter aircraft (Figure 2) developed by 
Saab-Scania underwent its first flight in 1974. The aircraft design 
features a single-channel high-authority digital automatic flight contro 
system (DAFCS) provided by Honeywell and mechanical primary FCS. 
Functions provided by the DAFCS include a control augmentation system, 
attitude hold (pitch, roll, heading, and control stick steering), 
altitude hold, and automatic airspeed control. The aircraft contains 
three primary control surfaces (right/left elevon and rudder) which are 
controlled by the pilot via the mechanical PFCS, by the DAFCS via 
secondary series servo, and via automatic or manual parallel and series 
trim actuators. 

The Airbus A-310 transport, currently in production, was first 
flight tested in 1982, and features a mechanical primary flight control 
system, DFBW spoilers, and a digital automatic flight control system. 

The spoiler system is dual-channel fail safe with identical active and 
monitor channels and uses dissimilar hardware (processors) and 
software. 
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Figure 2 





AIRBUS A-320 


Airbus Industries (Al) is in the detailed design stage in the 
development of a 150-seat, short/medium range A-320 transport (Figure 
3) featuring a quadruplex DFBW flight control system (FCS) . Mechanical 
control rudder and mechanical backup pitch trim are retained to permit 
safe landing in the event of power loss. Tests in the Airbus A-300 
flight test aircraft have verified that it is possible to land in this 
configuration. The system design includes dissimilar redundancy 
in both hardware and software of the same general type used in the A- 
310 spoilers. The A-320 will also incorporate relaxed static stability 
to at least the neutral point and possibly negative static stability. 

A flight test program is underway using the A-300 test bed aircraft 
to evaluate the use of RSS and a side-stick controller on the A-320. 

The evaluations will determine the engineering operational and 
certification issues of such systems on civil aircraft. The engines 
will incorporate full-authority digital engine control integrated with 
the flight management system. 


Operational Aircraft 

Under Development 
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Figure 3 
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A-320 DFBW SYSTEM 


A more detailed description of the A-320 DFBW system design 
features is shown in Figure 4. All primary flight control surfaces 
(elevators, horizontal stabilizer, ailerons, and roll spoilers) are 
quadraplex digital fly-by-wire using dissimilar redundancy in both 
hardware and software. The rudder control is mechanical, and the 
tail plane trim has a mechanical backup to provide emergency landing 
capability. The secondary controls (slats, trim, speed brakes, and lif 
dumpers) are commanded electrically. 
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Mechanical control: 

- rudder 
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(alternative control) 



Figure 4 



AIRBUS INDUSTRIES FLIGHT CONTROL SYSTEM EVOLUTION 

Airbus Industries (AI) planned development of a transport family is 
illustrated in Figure 5. Based on a continued, vigorous research and 
development program, including full-scale experimental testing, 
advanced technologies are progressively introduced in aircraft designs 
providing practical, evolutionary changes rather than revolutionary. 

The next transport is the 150-seat A-320 described previously. A 
series of wide-body aircraft is in the preliminary design stage: a two- 

engine short/medium range TA-9; a four-engine long-range TA-11; and, a 
two-engine medium/long range TA-12. The first two of these, TA-9 and 
TA-11, are expected to incorporate full-authority digital fly-by-wire 
systems on all surfaces, extensive use of active controls, and reduced 
energy systems. 
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TORNADO AND MIRAGE 


Figure 6 illustrates basic characteristics of the multinational 
Tornado and French Mirage 2000/4000 aircraft currently in production. 

The Tornado, a joint UK, FRG , and Italian project, underwent its 
first flight in 1976. The flight control system includes both analog 
and digital computing. The primary flight control function is 
performed by a command/stability augmentation system (CSAS) which is a 
triplex analog FBW maneuver demand system (Ref. 1). While no 
mechanical revision is provided for the rudder and spoilers, it is 
retained for the ailerons for safe return upon loss of CSAS computing. 

A dual digital autopilot/flight director (AFDS) integrated with the 
CSAS provides outer loop control. The AFDS uses cross-comparison 
techniques for failure detection and a signal consolidation scheme to 
provide triplex commands to the CSAS. It also provides a fail 
operational flight director capability to enable the pilot to monitor the 
autopilot performance and fly the aircraft manually if the autopilot 
malfunctions . 

The first flights of the Dassault-Brequet Mirage 2000 and 4000 
were conducted in 1978 and 1979, respectively. With no mechanical 
revision capability, both include a flight- critical analog FBW flight 
control system with digital autopilot. The 2000N version is nuclear 
hardened fitted with terrain-following radar. The Mirage 4000 features 
relaxed static stability and automatic variable camber to optimize 
performance. 


Operational Aircraft 
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• First flight 1976 

• Analog CSAS, dual digital autopilot, 
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Figure 6 



Tornado 
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JAS-39 AND LAV I 


Flight critical DFBW flight control systems designs are under 
development for opertional fighter aircraft in both Sweden and Israel 
(Fig. 7) . Saab-Scania of Sweden is developing the JAS-39 Gripen 
advanced strike fighter. Lear Siegler f Inc., will design, develop, 
and manufacture the flight control system. Under subcontracts, Moog 
Aerospace in cooperation with Saab Combitech will design the primary 
flight actuators, and Lucas Aerospace will supply the raaneuvering-f lap 
control actuation system. The JAS-39 will be a flight-critical triplex 
DFBW system and, thus, contains no mechanical backup capability. The 
fighter, scheduled for first flight in 1987, is being developed for 
specific mission needs of Sweden and may not favorably compete for an 
international market. 

The Israeli Aircraft Industries is developing the LAVI tactical 
fighter to replace the A-4 and Kfir C2 aircraft with first flight 
scheduled for 1986. The flight controls, to be designed by Lear 
Siegler (Moog) , will be a digital fly-by-wire system with relaxed 
static stability and include an analog but no mechanical backup system. 
Advanced digital avionics systems will be incorporated to operate with 
interactive multifunction displays/controls, fire control integrated 
with internal and external sensors, and enhanced active/passive self- 
defensive systems. As planned, much of the design and systems would be 
supplied by u.S. companies. 
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SKYSHIP 600 


In the UK, Marconi Avionics, under contract to Airship Industries, is 
developing a digital fly-by-light (DFBL) flight control system for 
application to the Skyship 600 (see Figure 8) . High inherent immunity 
to EM interference is achieved by a 1553 optical data bus between the 
FCC and the actuator drive system (ADS) and by providing dedicated 
electrical power at the ADS from a hydraulically driven electronic 
generator. The ADS includes a microprocessor to locally handle the 
failure detection and isolation. The actuators are duplex electric 
incorporating two samarium cobalt DC servomotors mounted on a common 
shaft, each fed by separate power. Torque is supplied by only one 
motor; the second is activated after failure of the first. 


Operational Airship 
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• UK (Airship Industries, Marconi) 

• First flight 1983 (with DFBL) 
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Figure 8 
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TIAWAN F-104 


The Aeronautical Research Laboratories of the Aeronautical Industry 
Development Center (AIDC) of the Republic of China in Tiawan has 
initiated a program to develop a modern digital flight control system 
to upgrade 100 F-104 aircraft (Fig. 9). The system will be a half- 
authority dual digital command augmentation system (CAS) and stability 
augmentation system (SAS) for pitch, roll, and yaw. The existing 
mechanical system and a new direct electrical command system will 
provide emergency backup capability. The prototype development 
contract for five aircraft systems is now under competition, and the 
first flight is expected to be early in 1987. 


Operational Aircraft 

FCS Upgrade 


F-104 
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• FCS under competition 

• First flight 1987 

• Dual digital CAS/SAS, mechanical 
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Figure 9 
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F-104 CCV AND JAGUAR DFBW 


Among the European R&D flight programs are the German F-104CCV and 
the United Kindom's Jaguar DFBW aircraft shown in Figure 10. The 
purpose of the German demonstration program was to investigate 
stability and control characteristics of a supersonic aircraft (Ref. 

2) . A single-seat F104G was modified as a control-configured vehicle 
(CCV) with a newly developed full-authority quadruplex system while 
retaining the original system as a mechanical backup. After initial 
flights starting in December 1977 to evaluate the DFBW system, various 
degrees of destabilization were achieved by adding aft ballast and a 
canard. The highest instability reached in normal flight was up to 22% 
mean aerodynamic chord at an angle of attack of 11 degrees. The flight 
tests were highly successful in demonstrating aircraft controllability 
in a highly unstable configuration. 

The Jaguar program was initiated to demonstrate a safe, practical, 
full-authority DFBW flight control system. This activity is of 
interest since it represents the first pure digital fly-by-wire system 
with no dissimilar backup. The program was initiated in 1977 under 
the technical sponsorship of the RAE and under contract to British 
Aerospace. Marconi Avionics furnished the flight control system. While 
more descriptions will follow, basically the FSC is a full-authority 
quadruplex DFBW system with optically coupled data transmission. The 
initial flight of aircraft was conducted in October 1981. 

R&D Flight Programs 


F-104 CCV 



• German (MBB) 

• First flight 1977 

• Quad DFBW, full-authority, mechanical 
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Figure 10 
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JAGUAR DFBW SYSTEM ARCHITECTURE 


The overall system architecture is shown schematically in Figure 
11 (Ref. 3) . Quadruplex computers and primary sensors were used to 
satisfy specifications requiring survival of any two electrical 
failures in the system and reliance on majority voting rather than self 
monitoring within each redundant element. Sensors of lower redundancy 
were used for those functions not necessary for safety of flight. A 
sextuplex or duo-triplex first-stage actuation scheme was selected to 
conform with stringent redundancy specifications. The two additional 
actuator channels are driven by the actuator drive and monitor 
computers which were independently voted versions of the FCC's outputs. 
Comprehensive built-in-test features were included to measure the 
system functional characteristics. While designed to run 
synchronously, the system has been operated asynchronously for 
continued periods without observable degradation. 
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Figure 11 
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JAGUAR DFBW - COMPUTING AND MONITORING ARCHITECTURE 


The basic system computing and monitoring architecture is presented 
in Figure 12 which illustrates a simplified primary control path (Ref. 
4). Quadruplex primary sensors, those necessary for flight safety, 
are interfaced with four identical flight control computers (FCC) which 
process these as well as less critical sensor signals into commands for 
control of the actuators. Cross-channel data transmission is achieved 
by optically coupled serial data links. This scheme enables each 
computer to carry out bit for bit identical control law implementation. 
Voting and failure rejection logic contained in each computer satisfies 
the requirement for surviving two sequential failures of all critical 
sensors. The actuation architecture required six independent servo 
drive signals. To avoid the cost and complexity of a full six-channel 
system, the four FCC's were augmented by dual analog actuator drive and 
monitor computers (ADMC) which utilize independently voted versions of 
the FCC output signals to drive the additional two channels. Failed 
FCC channels are detected and latched out, and then the ADMC averages 
the remaining good FCC channels. These additional channels are 
mechanized to eliminate any interchannel failure propagation between 
the six parallel redundant output interfaces. 


Flight Control Computers 



Figure 12 
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JAGUAR DPBW- DUO-TRIPLEX ACTUATOR SCHEME 


The basic specifications requiring that first-stage actuation has 
only two independent hydraulic supplies with no interconnect and that 
the system survives a hydraulic failure followed by an electrical system 
failure or the converse , led to the selection of duo-triplex first- 
stage actuation system design. While a quadruplex configuration would 
have offered an attractive one-to-one interface with the FCC’s, 
designers were concerned with mechanizing some form of fast reaction 
actuator monitoring and channel isolation scheme to prevent 
uncontrolled surface movement in the event of an electrical followed by 
a hydraulic failure. Each of the five control surface actuation 
systems is similar, and Figure 13 illustrates the operation (Ref. 4) . 
Each system contains six servovalves. An interactuator mechanical 
link assures that the spools move uniformly, which effectively sums the 
six servovalve outputs. Thus, failures in two channels are overridden 
by the other four. A separate hydraulic supply feeds each trio of 
servovalves and is also routed to the corresponding jack of the 
conventional tandem power control unit. A hydraulic supply failure is 
absorbed because the three associated servovalves are unable to oppose 
the correctly operating channels. 
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JAGUAR DFBW - SOFTWARE DEVELOPMENT PROCESS 


The use of common software in the flight control system presented 
the potential of a generic error leading to a safety critical loss of 
control. Therefore it was necessary to provide maximum software 
visibility to facilitate thorough testing and functional auditing 
during the design phase, supplemented by clear requirements definition, 
detailed documentation, and stringent production and configuration 
control procedures (Ref. 5). The key documents controlling the software 
design are the System Requirements Document (SRD) , which controls the 
design implementation, and the Software Structure Development (SSD) . 

The SSD defines the running order of the modules within each program 
segment and is designed to assure strict sequential data flow. 

The overall software development process is depicted in Figure 14. 
The SRD's are interpreted to produce software module design specifi- 
cations which in turn are used for module coding. A module test 
specification is written by an independent programmer to minimize error 
carry-over. The module code is tested, and the results are documented. 
Senior programmers audit all module documentation to assure that the 
design requirements are satisfied, the design rules observed, and the 
test process followed. When the module coding is completed, the modules 
are assembled and loaded into the hardware for integration tests. All 
of the software documentation is subjected to strict configuration 
control with changes authorized only through a formal change request 



Figure 14 
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JAGUAR DFBW - SYSTEM INTEGRITY APPRAISAL 

The basic integrity of the system was achieved by the selection of 
the system architecture in conjunction with standard design practices f 
performance testing, and assessments of operational/safety 
considerations. For the Jaquar DFBW program, these procedures were 
extended to include an integrity appraisal or system audit as outlined 
in Figure 15. The main elements (Ref. 5) were: 

100% coverage single-fault FMEA 
Multiple-fault FMEA for specific combinations 
Flight resident software integrity appraisal 
Appraisal of specific functions 
Configuration inspection 
- Qualification program 
Burn-in program 

These were supplemented by secondary analyses' shown below the main 

elements in the figure. As part of the integrity appraisal, various 
functions and features of the system were subjected to technical 
evaluations as required from results of mainstream failure mode and 
effects analysis (FMEA) and/or engineering findings. While the 
appraisal was conducted by a team knowledgeable in the specific design, 
they reported to senior engineers. 



Figure 15 
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JAGUAR DFBW - SYSTEM QUALIFICATION PROCESS 


Once the design objectives had been specified as subsystem or 
elements, such as the FCS, it was necessary to integrate these elements 
into a functional system exhibiting the characteristics of the basic 
design requirement while assuring that no adverse intersystem reactions 
were present and verifying that the common software used contained no 
generic or other design defects. These tasks were conducted using a 
ground test rig, the aircraft, and an independent software audit, 
interrelated as shown in Figure 16 (Ref. 5) . 

The ground test rig was used to (1) verify the control laws by 
pilot assessment, (2) integrate the hardware, software, and ancillary 
equipment, (3) validate the final software before flight, and (4) gain 
overall system confidence. In addition, it served as a pilot training 
aid and as a preflight test bed. 

The aircraft ground tests included complete checkout and test of 
the installed flight control system, electro-magnetic compatibility 
testing, aircraft systems testing, and simulated lightning tests. 

It was considered essential that an independent software test by a 
disinterested group be used to supplement the rig and aircraft tests. 
The group was responsible for emulation of the flight control computer 
using a general purpose machine and for manual code analysis. 



Figure 16 
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AUGUSTA A-129 AND T-2 CCV 


Flight test programs are being conducted by both Italy and Japan 
(Figure 17) . 

The Italian Augusta A-129 helicopter has been undergoing tests, and 
five prototype vehicles are to be manufactured in anticipation of 
production. The A-129 features a DFBW tail rotor (nonflight critical) 
but retains other mechanical controls. The design includes a digital 
autopilot and an integrated multiplexing system using microprocessors 
for aircraft/firing systems control. 

Under contract to the Japanese Defense Agency, Mitsubishi has built 
a control-configured vehicle version of the T-2 advanced trainer for 
use as a research aircraft. The T-2 CCV has composite all-flying 
canards located on the inlets ahead of the wing leading edge and a 
composite ventral fin located on the fuselage center line. The flight 
control system is triplex digital with mechanical backup. The first 
flight was conducted in August 1983, and the aircraft is scheduled for a 
two-year experimental flight test program by the Japanese Air Self 
Defense Force. 

R & D Flight Programs 


Agusta A-129 



T2 CCV 



• Italy 

• First flight 1983 

• DFBW tail rotor, digital autopilot, 
mechanical rotor controls 

• Multiplex data bus/integrated avionics/ 
flight control 


• Japan (Mitsubishi) 

• First flight 1983 

• Triplex DFBW, mechanical reversion 

• All moving canard/RSS 


Figure 17 
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ADVANCED AIRCRAFT DEVELOPMENT 


Britain and France are currently competing for leadership of a new 
generation European combat aircraft advance development program which 
may lead to a joint development with Germany for 1990's fighter 
aircraft (Fig. 18) . 

Led by British Aerospace/ a seven-member industrial consortium 
has an agreement with the British Ministry of Defense for government 
funding up to and including first flight for the development of an 
Agile Combat Aircraft (ACA) technology demonstrator called an 
experimental aircraft program (EAP) . Both West German and Italian 
aerospace companies have contributed some funding, and while not 
committed, the West German and possibly the Italian governments may 
fund a second demonstrator aircraft. The ACA flight control system 
design by Marconi Avionics would be quadruplex digital fly-by-wire 
(DFBW) with no mechanical backup and no dissimilar redundancy. 

(Marconi considers that, while not required for military application, 
dissimilar redundancy is necessary in commercial aircraft for 
certification purposes.) 

France has a comparable program since Dassault-Berguet (D-B) has 
begun manufacture of one technology demonstration aircraft. Avion de 
Combat Experimental (ACX) . It will be a DFBW design with no mechanical 
backup and include electrical and fiber optics data busing, voice 
control system, holographic displays, and provision for antiturbulence 
ride control in the automtic computer-controlled flight control system. 

The Federal Republic of Germany has need for a fast-reaction 
fighter, and their special requirements are prompting them to consider 
an entirely new fighter airframe called the TKF-90 which would employ 
existing avionics technologies to minimize costs. Two German 
companies, Messerschmett-Boelkow-Blohm (MBB) and Dornier, are pursuing 
test programs to satisfy the German Air Force needs but neither is 
committing to a flying demonstrator. MBB is using a modified Saab 
Viggen as a test bed to investigate various performance envelopes and 
is testing vectoring nozzle canards and other advanced control 
features. MBB has considerable experimental background in fire and 
flight control systems resulting from their F-104 CCV test bed. 

Dornier in conjunction with Northrop has an ND-102 design and is 
using a modified Alpha jet to test a new transonic wing and to experi- 
ment with direct side force controls and maneuvering flaps/slats. 

Thus, at the time of this writing, there are three fighter design 
plans among the UK, France, and FRG. Considering the economics 
involved, it is likely that more than one or possibly two will be fully 
developed. Both the UK and France seek partnership with the frg, and it 
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is likely that at least the TFK-90 will be a compromise between the ACA 
and ACX programs. MBB of West Germany is, in fact, a partner on the 
ACA and is being actively pursued as a partner in France's ACX program. 
MBB could become the catalyst for a European-wide project with British 
Aerospace and Dassault-Berquet and themselves as principals. While 
specific mission requirements would be compromised, such a triumvirate 
would create an attractive production market and serve as a formidable 
obstacle for u.S. competitors. 

Italy (Aer italia-Macchi) and Brazil (Embraer) are jointly 
developing the AMX fighter with first flight scheduled for 1984 and 
delivery in 1987. Initial production is expected to provide 1.85 
aircraft for Italy and 80 for Brazil. The electronic flight control 
system designed by Marconi provides duplex analog fly-by-wire control 
of the tail plane, spoilers, and rudder together with mechanical 
elevators and ailerons. The design also incorporates automatic pitch, 
roll, and yaw stabilization. The equipment comprises two dual- 
redundant flight control computers based on 16-bit microprocessors 
organized for specially developed fail-safe software. To optimize 
hardware requirements, analog computing is used for the actuator 
control loops, pilot command path, and rate damping computations. 
Digital computing is used to handle gain schedules, electronics trim, 
and airbrake integrators. System performance is monitored by redundant 
processors in the flight control computers. 


Advanced Aircraft Development 


ACA, ACX 




• UK/FRG (BAe, MBB, Marconi) 

• First flight 1986 

• Quad DFBW, no mechanical reversion, 
no dissimilar redundancy 

• Fr, FRG (Dassault-Breguet, MBB?) 

• First flight 1986 

• DFBW, no mechanical reversion, 
fiber optic data bus 

• Ride control, voice command, 
holographic HUD 

• Italy, Brazil (Aeritalia/Marcchi, 
Embraer, Marconi) 

• First flight 1984 

• Duplex analog FBW, digital gain 
sched/monitoring (tailplane, 
spoilers, rudder) 


Figure 18 
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